What is Bellingcat? Behind the tactics revealing the Skripal suspect and Cameroon killers

How a collection of amateur investigators pioneered a technique that exposes state secrets and unmasks criminals.

NS

Sign Up

Get the New Statesman's Morning Call email.

“Skripal Suspect Boshirov Identified as GRU Colonel Anatoliy Chepiga”. As headlines go, it’s a biggie. One of the men accused of poisoning the Skripals with Novichok nerve agent – and killing another Salisbury resident – has been identified as a senior officer in the Russian military intelligence service.

The geopolitical ramifications are huge, but the source of the story is small. Tiny, in fact. A handful of around a dozen independent online journalists who contribute to a website set up in 2014 by a 39-year-old blogger in Leicester.

Bellingcat was founded using crowdfunding from a Kickstarter campaign by the blogger Eliot Higgins. After being laid off from his administrative job, Higgins began blogging in his living room under the pseudonym Brown Moses (named after a Frank Zappa song he happened to be listening to) in 2012, mainly collating and analysing footage and photos coming out of the Syrian civil war and elsewhere in the Middle East. He was also looking into the phonehacking scandal that was wobbling the Murdoch empire at that time.

Watching hundreds of videos on YouTube and other social networking sites every day, Higgins was able to piece together stories that governments and international organisations had not. Never having visited Syria, and without speaking Arabic, Higgins proved the Syrian government’s use of barrel bombs and cluster munitions – and made his big break linking the chemical attack in Ghouta to Bashar al-Assad.

Catching the attention of human rights organisations, security services and journalists, Higgins and his band of fellow online analysts went on to investigate further big international stories using open source content on Bellingcat.

Through social media, photos, maps, satellite imagery and exposing falsified Russian images, they linked the downing of flight MH17 to a specific Russian military unit. And of course, most recently, they pinned the Skripal poisoning on the Russian secret services.

Known as “OSINT” (open-source intelligence), Bellingcat’s method of journalism collects data from publicly available sources to piece together, debunk or verify a story. In October 2013, the Google Ideas think tank came up with a catchier label: “Armchair Analytics”.

Indeed, when Higgins began raking through citizen journalism coming out of Syria over six years ago, he was doing so from his sofa – his work had to fit around looking after his young daughter, now six years old, while his wife was at work.

And there were many other amateurs online using similar methods. They meet and talk in Facebook groups, subreddits and threads of direct messages on Twitter, discussing new tools and techniques and working with any changes to social networks that might help or hinder their work.

“A lot of people who are involved with Bellingcat are from those communities, and have a kind of nerdy desire or obsession with problem-solving when it relates to big stories,” says Press Association social media journalist, Alastair Reid, who was part of what he calls this “scene” and edited Higgins’ work in 2015 while managing editor of First Draft (a collaborative site funded by Google that involved Bellingcat and News Corp-owned “social media intelligence agency” Storyful to fight misinformation online).

“From conversations with Eliot and from knowing Eliot, that’s where he started – with that kind of obsession with figuring out where a lot of the weapons being used in the Syrian civil war came from, and developing his skills by himself and in his communities that way.”

One of the key drivers of this online community was the Arab Spring in 2011 – with so many pictures and videos coming out of the countries involved, and corresponding misinformation campaigns, they set their minds to verifying and sourcing the footage and social media posts.

Although the Skripal story uses old-school journalism methods – trusted, well-placed sources and leaked databases – most of Higgins’ sources are publicly available. Satellite imagery (every inch of the earth has been photographed), maps, heatmaps, reverse image searches, metadata of picture or video files, and simply looking at the weather, the clothing, the angle of shadow and landmarks in the photos or footage you’re analysing.

Verification tools are available online, and Higgins publishes his methods so that everyone can learn.

“A lot of investigators, whether they’re journalists or human rights investigators or whatever, they have a toolkit to verify a video, to geolocate something, or identify the military insignia on a soldier’s uniform ,” says Kristyan Benedict, campaigns manager at Amnesty International UK, who focuses on Syria and first became aware of Higgins’ work in 2012 investigating whether the regime was dropping barrel bombs.

“Whereas one of the interesting things about Eliot is he would share those tools, he would open it out to people, which was interesting and good and it comes back to that more humble approach.”

A stunning example of this method going mainstream was BBC Africa’s recent exposé of a massacre in Cameroon – which identified each of the killers:


For this story, freelance investigators (including Bellingcat contributors) helped BBC journalists pinpoint the location of the harrowing footage, analysed the type of weapons the men were carrying, and identified the soldiers. They also worked out when and which time of year it happened.

Higgins, who is now sought after for consultancy work and classes, also inspired human rights organisations into focusing and publishing their findings with more urgency.

“It’s pushed a lot of organisations, including Amnesty, to be a lot more proactive in the way they do investigations,” says Benedict. “The core model of working your contacts, getting on the ground, interviewing people is still there – but there’s suddenly more tools, more information available, and to be seen to be using all of these tools is also important.”

But publicly using such skills comes at a price. RT, the Russian state broadcaster previously known as Russia Today, goes after him relentlessly – mocking his “ironclad Instagram investigations”, labelling him a “NATO-funded blogger”, making films attacking his credibility, and doorstepping his relatives. He has also been smeared as a stooge for western intelligence services.

“Originally of course he was seen as this CIA stooge, but he was well ahead of the intelligence services both on the Malaysian Airlines and chemical attacks in Syria… This whole new form of online forensics,” says Peter Jukes, an author and blogger well-known for live-tweeting the whole phonehacking trial, who has contributed to Bellingcat and used Brown Moses work on private detectives in the phonehacking scandal as a source for his work.

“And the consistent attack on Eliot for the last four years since the Ukrainian invasion has just been extraordinary, they’re obviously worried about him,” he adds.

Following the Skripal scoop, Bellingcat must stay “one step ahead in terms of staying safe”, warns Benedict – regarding both its digital and operational security. Jukes says the group makes sure to be electronically secure, and as Russia prefers to attack or undermine Higgins’ evidence ,“I think it will be fine, as long as he doesn’t go for a relaxed holiday on the Black Sea”.

Putting your head – or at least your evidence – above the parapet is baked into Bellingcat’s brand. When setting up the site, Higgins “was looking for a name and he said the ‘Global Wire’ or ‘Wireless’ or something”, recalls Jukes, who ended up suggesting its current name. “Belling the Cat” is a medieval fable about a group of mice, terrorised by a cat, who come up with a plan to put a bell around its neck to alert them to danger. The only problem is, which mouse would take that risk?

Anoosh Chakelian is senior writer at the New Statesman.